@isomorph.ai/cli 0.8.3 → 0.9.0

package/dist/packages/harbour-cli/src/check.js

@@ -27,13 +27,13 @@ export function checksFailedMessage(report) {
 /** The bound on the reason carried into the refusal; the rest stays in the report. */
 const DETAIL_CAP = 200;
 /** Where the rest of it is, and the one command that re-runs them. */
-export const CHECKS_FAILED_HINT = "Full detail is in .isomorph/local/check-report.json; fix what it reports, then run `isomorph check --app-root .` again.";
+export const CHECKS_FAILED_HINT = "Full detail is in .isomorph/check-report.json; fix what it reports, then run `isomorph check --app-root .` again.";
 /** The name the gate reports operation coverage under — the pipeline's rule for it. */
 export const FLOW_CHECK = "flow.check-failed";
 /** The CLI's own check over `jobs/`: a company operation a job calls that would run as a person. */
 export const JOBS_CHECK = "jobs.identity";
 /**
- * Runs the kit checks and writes `.isomorph/local/check-report.json`; a source
+ * Runs the kit checks and writes `.isomorph/check-report.json`; a source
  * edit changes sourceDigest and so invalidates the previous report. The app's
  * own toolchain first (typecheck, build), then the kit gate — the pipeline's
  * gate, run by the pinned native gateway in this app's local session — whose

package/dist/packages/harbour-cli/src/deploy.js

@@ -1,6 +1,7 @@
 import { basename, dirname, resolve } from "node:path";
 import { readFile, mkdir, rename, writeFile } from "node:fs/promises";
 import { createSourceManifest } from "../../../src/source-intake.js";
+import { sourceDigestOf } from "../../../src/source-digest.js";
 import { archiveForManifest, putMultipart } from "./upload.js";
 import { CliError } from "./output.js";
 import { continueCommand, follow, outcomeFor, pickSourceFailure, recordedRefusal, runningLine, statusFetch, summarize } from "./operations.js";
@@ -80,12 +81,14 @@ async function runDeploy(rootArg, governance, output, tenantId, options) {
     // it runs, so the tree is scanned only after it.
     await ensureChecksPassed(root, output, options);
     const { graph, files } = await readAppTree(root);
+    const report = await packagedReport(root, files);
     output(`Isomorph found ${files.length} app files.`);
-    // The package: built once, from the bytes read above; `archiveForManifest`
-    // re-reads every file and compares its sha256, so a tree that moved under us
-    // is refused here rather than uploaded. Its digest is the operation's
-    // identity on the server — the same package resumes the same operation.
-    const manifest = await createSourceManifest({ tenantId, appId, operationId: LOCAL_MANIFEST_OPERATION, graphDigest: graph.graphDigest, files });
+    // The package: built once, from the bytes read above plus the report those
+    // bytes passed; `archiveForManifest` re-reads every file and compares its
+    // sha256, so a tree that moved under us is refused here rather than
+    // uploaded. Its digest is the operation's identity on the server — the same
+    // package resumes the same operation.
+    const manifest = await createSourceManifest({ tenantId, appId, operationId: LOCAL_MANIFEST_OPERATION, graphDigest: graph.graphDigest, files: [...files, report.file] });
     const archive = await archiveForManifest(root, manifest);
     const note = await readDeployNote(root, tenantId);
     if (note?.sha256 === archive.digest)
@@ -101,7 +104,7 @@ async function runDeploy(rootArg, governance, output, tenantId, options) {
         environment: "preview",
         app: { name: profile.name, description: profile.description, audience: profile.audience },
         package: { sha256: archive.digest, bytes: archive.body.byteLength, manifest: { schema: "isomorph.source-package-manifest/1.0", files: manifest.files.map(file => ({ path: file.path, size: file.bytes, sha256: file.sha256 })) } },
-        graph, cliVersion: CLI_VERSION, kitBundleVersion: bundle.kitVersion, declaration, callsAi: await appCallsAi(root), kitLock: kitLockBody(lock.bundle)
+        graph, cliVersion: CLI_VERSION, kitBundleVersion: bundle.kitVersion, declaration, callsAi: await appCallsAi(root), kitLock: kitLockBody(lock.bundle), checkReport: report.summary
     };
     let opened;
     try {
@@ -194,7 +197,7 @@ function skippedGates(report) {
  * Makes sure the checks have passed *for this tree*, running them when they
  * have not.
  *
- * `isomorph check` writes `.isomorph/local/check-report.json` with the digest of
+ * `isomorph check` writes `.isomorph/check-report.json` with the digest of
  * the source it ran against. A report is trusted when three things are true:
  * the checks ran, they ran against these bytes, and the ones that matter
  * actually ran rather than being skipped. Then nothing is run again — the gate
@@ -240,6 +243,28 @@ async function ensureChecksPassed(root, output, options) {
     if (skipped.length)
         throw new CliError("CHECKS_NOT_RUN", `The checks skipped ${skipped.length} gate${skipped.length === 1 ? "" : "s"} instead of passing ${skipped.length === 1 ? "it" : "them"}. The deployment pipeline runs the same ones in the cloud, so skipping them here only moves the failure.`, undefined, "Start `isomorph dev --app-root .`, run `isomorph check --app-root .`, then run this again.", undefined, { paths: skipped });
 }
+/** The report's path inside the package: beside the lock, where intake looks for it. */
+const REPORT_PACKAGE_PATH = ".isomorph/check-report.json";
+/**
+ * The report `ensureChecksPassed` trusted, read once as the bytes the package
+ * carries and the three values the deploy route reads. Intake recomputes the
+ * tree's digest and refuses a package whose report is for other bytes, so the
+ * pair is held to that rule here first, against the files going into the
+ * archive rather than a second scan.
+ */
+async function packagedReport(root, files) {
+    let content;
+    try {
+        content = new Uint8Array(await readFile(kitPaths(root).report));
+    }
+    catch {
+        throw new CliError("CHECKS_NOT_RUN", `Isomorph could not read ${REPORT_PACKAGE_PATH}.`, undefined, "Run `isomorph check --app-root .`, then run this again.");
+    }
+    const report = JSON.parse(new TextDecoder().decode(content));
+    if (report.passed !== true || report.sourceDigest !== sourceDigestOf(files))
+        throw new CliError("CHECKS_STALE", "The app changed while it was being packaged, so its check report is not for this code.", undefined, "Run the same deploy command again: it checks the app as it is now.");
+    return { file: { path: REPORT_PACKAGE_PATH, content }, summary: { sourceDigest: report.sourceDigest, passed: report.passed, createdAt: report.createdAt } };
+}
 /** The checks as `isomorph check` runs them, with the bundle this deploy carries. */
 function defaultRunChecks(options) {
     const bundle = options.bundle ?? EMBEDDED_KIT_BUNDLE;
@@ -309,7 +334,7 @@ function outcomeLine(summary) {
 }
 /**
  * Whether the app really calls governed AI: the gate's inventory of
- * `isomorph.ai.*` call sites (`.isomorph/local/check-report.json`,
+ * `isomorph.ai.*` call sites (`.isomorph/check-report.json`,
  * `gate.inventory.aiCallsites`). Not the capability word — a starter that
  * merely carried an `ai()` accessor was derived as `ai` and would have been
  * refused `AI_NOT_READY` at a company without AI for an app that never asks

package/dist/packages/harbour-cli/src/kit.js

@@ -3,6 +3,7 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, dirname, join, parse, resolve } from "node:path";
 import { scanWorkspace } from "../../../src/analyzer.js";
+import { sourceDigestOf } from "../../../src/source-digest.js";
 import { isKitBundle } from "./kit-bundle.js";
 import { CliError } from "./output.js";
 /** Explicit reads `isomorph check --integrations` may run; every other operation is a send and never runs during checks. */
@@ -131,7 +132,7 @@ export function newKitLock(bundle, tenantId = "", appId = "") {
     return { schema: "isomorph.kit-lock/1.0", appId, tenantId, bundle, createdAt: now, updatedAt: now };
 }
 // ---- Paths and identity --------------------------------------------------------
-/** Where a kit app keeps its declaration, lock and app profile (committed), and its generated checks and local state (ignored). */
+/** Where a kit app keeps its declaration, lock and app profile (committed), the check report `deploy` packages, and its generated checks and local state (ignored). */
 export const KIT_DIRECTORY = ".isomorph";
 export function appRoot(rootArg) {
     if (!rootArg)
@@ -144,7 +145,7 @@ export function appRoot(rootArg) {
 export function kitPaths(root) {
     const kit = join(root, KIT_DIRECTORY);
     const local = join(kit, "local");
-    return { kit, local, declaration: join(kit, "integrations.json"), app: join(kit, "app.json"), lock: join(kit, "kit.lock.json"), devLock: join(local, "dev.lock"), state: join(local, "state"), report: join(local, "check-report.json"), deployNote: join(local, "deploy.json") };
+    return { kit, local, declaration: join(kit, "integrations.json"), app: join(kit, "app.json"), lock: join(kit, "kit.lock.json"), devLock: join(local, "dev.lock"), state: join(local, "state"), report: join(kit, "check-report.json"), deployNote: join(local, "deploy.json") };
 }
 /** The description `init` writes: recognisable later, so a profile nobody has reviewed is never sent to IT. */
 const STARTER_DESCRIPTION_SUFFIX = ": an app built on Isomorph.";
@@ -250,24 +251,20 @@ export function linkIdempotencyKey(tenantId, root) {
     return createHash("sha256").update(`${tenantId}${resolve(root)}`).digest("hex");
 }
 /**
- * sha256 over the tracked app files (same boundary as deploy), so any
- * edit changes it — and, per file, the hash of its contents, so a stale check
- * can say WHICH path moved rather than only that something did. The boundary
- * leaves `.isomorph/checks/` out (analyzer.ts): the gate regenerates it on
- * every check, and a regeneration is not a change to the app.
+ * sha256 over the tracked app files (same boundary as deploy; `sourceDigestOf`
+ * is the one function intake recomputes it with), so any edit changes it —
+ * and, per file, the hash of its contents, so a stale check can say WHICH
+ * path moved rather than only that something did. The boundary leaves
+ * `.isomorph/checks/` and the report itself out (analyzer.ts): the gate
+ * regenerates the one on every check, and writing the other is not a change
+ * to the app.
  */
 export async function sourceDigest(root) {
     const graph = await scanWorkspace(root, { sourceBoundary: "root" });
     const files = [...graph.deploymentScope.includedFiles].sort();
-    const hash = createHash("sha256");
-    const entries = {};
-    for (const path of files) {
-        const content = await readFile(join(root, path));
-        hash.update(path).update("\0");
-        hash.update(content).update("\0");
-        entries[path] = createHash("sha256").update(content).digest("hex");
-    }
-    return { digest: `sha256:${hash.digest("hex")}`, files, entries };
+    const contents = await Promise.all(files.map(async (path) => ({ path, content: new Uint8Array(await readFile(join(root, path))) })));
+    const entries = Object.fromEntries(contents.map(file => [file.path, createHash("sha256").update(file.content).digest("hex")]));
+    return { digest: sourceDigestOf(contents), files, entries };
 }
 /**
  * What moved between the tree the checks ran on and the tree being deployed.

package/dist/packages/harbour-cli/src/starter.js

@@ -126,7 +126,7 @@ async function appendManaged(root, file, block, result, separator, start, end) {
 const exists = (path) => stat(path).then(() => true, () => false);
 const readJson = (path) => readFile(path, "utf8").then(text => JSON.parse(text), () => undefined);
 // ---- Templates -----------------------------------------------------------------
-const GITIGNORE_LINES = ["node_modules/", "dist/", ".isomorph/local/", ".isomorph/checks/"].join("\n");
+const GITIGNORE_LINES = ["node_modules/", "dist/", ".isomorph/local/", ".isomorph/checks/", ".isomorph/check-report.json"].join("\n");
 /**
  * The per-app block: it says where the rules are and when to read each, and nothing
  * else — the rules themselves live in the modules `agent-setup` writes beside the

package/dist/src/analyzer.js

@@ -250,19 +250,41 @@ function pushMatches(content, pattern, names) {
         names.push(match[1] ?? match[2] ?? "");
     }
 }
+/** A read that only exists on a comment line is not a read: `// stripeSecretKey:
+ * process.env.STRIPE_SECRET_KEY,` asked a builder for a key on 20 Sept 2026. */
+const COMMENT_LINE = /^\s*(?:\/\/|#|\*|\/\*|<!--)/;
+/** `const { SMTP_HOST, SMTP_PASS } = process.env` reads every destructured name. */
+const ENV_DESTRUCTURE = /\{([^}]*)\}\s*=\s*process\.env\b/g;
+/** `NAME=` at the start of a shell line declares a local variable; `$NAME`
+ * later in that file is not an environment read. */
+const SHELL_LOCAL_ASSIGNMENT = /^\s*(?:export\s+)?([A-Z0-9_]{3,})=/gm;
+function uncommentedLines(content) {
+    return content.split(/\r?\n/).filter(line => !COMMENT_LINE.test(line)).join("\n");
+}
 function detectEnvNames(files) {
     const names = [];
     for (const file of files) {
-        const content = file.content ?? "";
+        const content = uncommentedLines(file.content ?? "");
         for (const pattern of ENV_ACCESS_PATTERNS)
             pushMatches(content, pattern, names);
-        if (isShellContextFile(file.basename))
-            pushMatches(content, SHELL_EXPANSION_PATTERN, names);
+        for (const match of content.matchAll(ENV_DESTRUCTURE)) {
+            for (const part of (match[1] ?? "").split(",")) {
+                const name = /^\s*([A-Z0-9_]{3,})\s*(?::|=|$)/.exec(part)?.[1];
+                if (name)
+                    names.push(name);
+            }
+        }
+        if (isShellContextFile(file.basename)) {
+            const locals = new Set([...content.matchAll(SHELL_LOCAL_ASSIGNMENT)].map(match => match[1] ?? ""));
+            const expanded = [];
+            pushMatches(content, SHELL_EXPANSION_PATTERN, expanded);
+            names.push(...expanded.filter(name => !locals.has(name)));
+        }
         // package.json scripts run in a shell; expansion applies to the script
         // strings alone, never to the raw JSON (dependency names, config values).
         if (file.basename === "package.json") {
             try {
-                const scripts = JSON.parse(content).scripts ?? {};
+                const scripts = JSON.parse(file.content ?? "").scripts ?? {};
                 for (const value of Object.values(scripts)) {
                     if (typeof value === "string")
                         pushMatches(value, SHELL_EXPANSION_PATTERN, names);
@@ -271,7 +293,7 @@ function detectEnvNames(files) {
             catch { /* Invalid manifests contribute no names. */ }
         }
         if (isEnvTemplateFile(file.basename)) {
-            for (const line of content.split(/\r?\n/)) {
+            for (const line of (file.content ?? "").split(/\r?\n/)) {
                 const envMatch = /^([A-Z0-9_]{3,})=/.exec(line.trim());
                 if (envMatch)
                     names.push(envMatch[1] ?? "");

package/dist/src/secret-paths.js

@@ -18,15 +18,17 @@ export function isSourceIntakeExcludedPath(path) {
         || /(^|\/)\.github\/workflows\//i.test(path);
 }
 /**
- * The development kit commits exactly these files under `.isomorph`: the
- * integrations declaration, the kit lock and the app profile. Everything else
- * there stays local — local state, and the generated `checks/` and
+ * The development kit ships exactly these files under `.isomorph`: the
+ * integrations declaration, the kit lock, the app profile, and the check
+ * report `isomorph check` wrote for the tree being deployed (packaged by
+ * `deploy`, never scanned into the tree it digests). Everything else there
+ * stays local — local state, and the generated `checks/` and
  * `ai-inventory.json`, which the pipeline's kit lane regenerates from the
  * source it builds (data plane ADR 0014); a builder's own checks are
  * `tests/*.mjs` at the app root, ordinary source.
  */
 export function isKitCommittedPath(path) {
-    return /(^|\/)\.isomorph\/(?:integrations\.json|kit\.lock\.json|app\.json)$/.test(path);
+    return /(^|\/)\.isomorph\/(?:integrations\.json|kit\.lock\.json|app\.json|check-report\.json)$/.test(path);
 }
 /**
  * Dependency and internal directories the intake never stages: `node_modules`,

package/dist/src/source-digest.js

@@ -0,0 +1,16 @@
+import { createHash } from "node:crypto";
+/**
+ * The digest `isomorph check` pins in its report and `isomorph deploy` and
+ * source intake recompute: sha256 over the app's files sorted by path, each as
+ * `path\0content\0`. One function on both sides of the upload, so a report
+ * that matched on the laptop matches at intake for the same bytes, and the
+ * order the files arrive in never matters.
+ */
+export function sourceDigestOf(files) {
+    const hash = createHash("sha256");
+    for (const file of [...files].sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0))) {
+        hash.update(file.path).update("\0");
+        hash.update(file.content).update("\0");
+    }
+    return `sha256:${hash.digest("hex")}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isomorph.ai/cli",
-  "version": "0.8.3",
+  "version": "0.9.0",
   "description": "Isomorph development kit CLI",
   "type": "module",
   "bin": {
@@ -19,6 +19,7 @@
     "dist/src/contracts.js",
     "dist/src/digest.js",
     "dist/src/secret-paths.js",
+    "dist/src/source-digest.js",
     "dist/src/source-intake.js",
     "package.json"
   ],